🚨 New threat: GhostRedirector hacked 65+ Windows servers worldwide.

It installs backdoors & an IIS malware that tricks Google into boosting shady gambling sites—damaging the reputation of legit businesses.

Details here → https://thehackernews.com/2025/09/ghostredirector-hacks-65-windows.html

Russian hackers turned Microsoft Outlook into a cyber weapon.

APT28’s new NotDoor malware lurks in Outlook, triggered by emails to steal files, run commands, and spy on companies across NATO countries.

It hides by abusing Microsoft’s own trusted tools.

Full story → https://thehackernews.com/2025/09/russian-apt28-deploys-notdoor-outlook.html

🚨 523 malicious SVG files are slipping past antivirus scans.

Hackers are posing as Colombia’s Attorney General, using fake “document downloads” to secretly drop malware.

The kicker? Every sample evaded detection.

Here’s what’s going on ↓ https://thehackernews.com/2025/09/virustotal-finds-44-undetected-svg.html

Pentest reports are broken.

Teams are still stuck with static PDFs while attackers move in real time.

Now, platforms like PlexTrac deliver findings instantly—no waiting, no manual ticketing, no weeks-long delays. Faster fixes, lower risk.

Here’s how it changes the game ↓ https://thehackernews.com/2025/09/automation-is-redefining-pentest.html

🚨 The Salesloft Drift breach has ignited a flurry of incident disclosures from SaaS providers, making it hard for security teams to keep up.

Nudge Security has put together a tracker for notifications related to this breach which will be updated as more providers issue communications.

Stay up to date here: https://thn.news/breach-tracker

🚨 Cyber gang TAG-150 just built CastleRAT in Python & C — a new trojan that steals passwords, hijacks crypto wallets, logs keystrokes & takes over PCs.

It’s the latest weapon in their CastleLoader malware ops.

Full story → https://thehackernews.com/2025/09/tag-150-develops-castlerat-in-python.html

🚨 Critical: A 9.0 severity bug in Sitecore is being actively exploited.

Hackers are using machine keys copied straight from old docs to hijack servers with full remote code execution.

Here’s what defenders need to know → https://thehackernews.com/2025/09/cisa-orders-immediate-patch-of-critical.html

🚨 Russia-linked hackers just hit Kazakhstan’s energy giant KazMunaiGas.

The op—codenamed BarrelFire—used fake IT emails and booby-trapped ZIP files to drop malware, hijack systems, and open a backdoor.

The worst part? It came from a real employee’s stolen account.

Read more ↓ https://thehackernews.com/2025/09/noisy-bear-targets-kazakhstan-energy.html

⚡ Miss this week’s cyber news? You skipped:

– Drift breach chaos
– Active zero-days
– Dark web buzz
– Critical CVEs

Don’t fall behind — catch the full recap 👇 https://thehackernews.com/2025/09/weekly-recap-drift-breach-chaos-zero.html

⚠️ Hackers aren’t sending phishing emails anymore. They’re joining your team.

Fake hires pass interviews with AI resumes + deepfakes, get onboarded, and walk away with your keys. Identity is the new perimeter.

Here’s what companies must change ↓ https://thehackernews.com/2025/09/you-didnt-get-phished-you-onboarded.html

🚨 Attackers didn’t hack your server—they stole a login. $1M ransom later, it was too late.

Modern identity tools can block risky logins in real time, using signals your security stack already collects. Don’t wait until after the breach.

See how → https://thehackernews.com/expert-insights/2025/09/how-to-build-identity-firewall-with.html

🚨 Salesloft confirms GitHub breach from Mar–Jun 2025 triggered Drift supply chain attack affecting 22 companies.

Hackers stole OAuth tokens, risking customer integrations. Drift remains offline as Salesloft secures systems.

Full story → https://thehackernews.com/2025/09/github-account-compromise-led-to.html

🚨 Hackers are hijacking Google search ads to trick devs into downloading malware disguised as GitHub tools.

The payload? A 128MB file that hides from sandboxes unless your GPU passes its “check.” Info theft & remote access are the endgame.

Details ↓ https://thehackernews.com/2025/09/gpugate-malware-uses-google-ads-and.html

🚨 Threat hunters just uncovered 45 domains tied to China-backed hackers Salt Typhoon & UNC4841—some active since May 2020.

These groups hit U.S. telecoms & exploited zero-days in Barracuda appliances. Your org could already be exposed.

Details here ↓ https://thehackernews.com/2025/09/45-previously-unreported-domains-expose.html

⚡ Firewalls aren’t enough anymore—AI attacks are evolving faster than traditional defenses.

Zscaler's Zero Trust + AI keeps your data safe, blocks ransomware, and lets you use AI securely without risk.

Here’s what the CEO Jay Chaudhry says about staying ahead ↓ https://thehackernews.com/videos/2025/09/zero-trust-ai-protecting-what-firewalls.html

🚨 20 npm packages with 2 BILLION+ weekly downloads (incl. chalk & debug) were hacked.

A maintainer was phished into giving up 2FA — attackers slipped in malware that hijacks wallets & steals crypto.

Here’s what went down ↓ https://thehackernews.com/2025/09/20-popular-npm-packages-with-2-billion.html

🚨 Hackers are hijacking exposed Docker APIs to spread a cryptojacking botnet—using TOR domains, masscan scans, and even Chrome debug ports to steal data & expand.

The wild part? The malware code includes an emoji, hinting it was LLM-built.

Here’s what’s happening ↓ https://thehackernews.com/2025/09/tor-based-cryptojacking-attack-expands.html

🚨 Two new cyber campaigns are live:

1️⃣ MostereRAT — phishing emails targeting Japan.
Disables Windows security, hijacks TrustedInstaller, installs AnyDesk/TigerVNC, logs keystrokes, and even adds hidden admins.

2️⃣ ClickFix 2.0 — fake AnyDesk + Cloudflare page tricking users into opening File Explorer → drops MetaStealer.

Hackers are raising the bar. Stay alert.

Read → https://thehackernews.com/2025/09/from-mostererat-to-clickfix-new-malware.html

🚨 88% of boards now see cybersecurity as a business risk. Yet every budget season, security still gets sidelined.

One insurer estimated a single PII breach = $5M+ loss.

The fix? Continuous, automated validation that proves ROI.

Here’s what CISOs are telling boards ↓ https://thehackernews.com/2025/09/how-leading-cisos-are-getting-budget.html

⚠️ Shadow AI Agents are already inside your enterprise.

→ Impersonating users
→ Leaking data
→ Multiplying out of sight

👀 You can’t defend what you can’t see.

Join our panel before Shadow AI outruns your defenses.

Register now → https://thehackernews.com/2025/09/webinar-shadow-ai-agents-multiply-fast.html

🚨 New Android threat: RatOn

• Drains crypto wallets (MetaMask, Trust, Phantom)
• Hacks Czech bank app George Česko for auto-transfers
• Spreads via fake TikTok apps
• Can lock your phone with ransom screens

Active since July. Still evolving.

Details here → https://thehackernews.com/2025/09/raton-android-malware-detected-with-nfc.html